The vulnerability is a use‑after‑free flaw in Microsoft Office Click‑To‑Run that allows an authorized attacker to elevate privileges locally. By triggering the flaw, the attacker can gain higher rights on the system. The weakness is classified as CWE‑416, indicating improper freeing of memory while a reference remains.

Microsoft 365 Apps for Enterprise, Microsoft Office 2019, Microsoft Office LTSC 2021, and Microsoft Office LTSC 2024 product lines are affected. Version information is not specified in the advisory, so all current releases of these products should be considered vulnerable until a patch is applied.

The CVSS score of 7.8 points to a high likelihood of a successful local privilege escalation, but the EPSS score is < 1% and the vulnerability is not listed in the CISA KEV catalog. The attack vector is inferred to be local with an authorized attacker, as the description states local privilege elevation. Adopting the latest Office updates mitigates the risk.